Designing a Multi-VLAN Enterprise Network from Scratch

Project overview

I designed this Cisco Packet Tracer lab from scratch to strengthen my understanding of how VLANs, IP subnets, trunk and access links, inter-VLAN routing, and static routes work together in one network.

The topology represents two routed sites connected through two Cisco 2911 routers. The left site uses a combination of router-on-a-stick and a dedicated routed interface, while the right site uses a Cisco 3650 multilayer switch with switched virtual interfaces (SVIs). The completed network contains five VLAN-based user networks, two point-to-point transit networks, and thirteen end devices.

The final validation was successful: every PC could communicate across its local VLAN, between VLANs, and across both sites.

Objectives

• Build a segmented network without following a preconfigured activity.

• Use VLSM to allocate address space according to host requirements.

• Configure access and trunk ports based on the VLANs carried by each link.

• Implement router-on-a-stick on R1 for VLANs 10 and 30.

• Connect VLAN 20 to a dedicated R1 physical interface through an access link.

• Configure SVIs and Layer 3 routing on SW3 for VLANs 10 and 40.

• Use routed /30 links between Layer 3 devices.

• Implement default routes on edge devices and specific static routes on R2.

• Verify complete end-to-end reachability.

Topology and devices

VLSM addressing plan

I began with the base network 192.168.10.0/24. The host requirements were sorted from largest to smallest before allocation. This was essential because assigning a small subnet first could place the next address on a boundary that is invalid for a larger prefix and cause overlapping networks.

Addressing decisions

• I used the last usable address as the default gateway for each VLAN, which is a valid and consistent addressing convention.

• The repeated VLAN ID 10 on the two sites does not make them one Layer 2 network. They are separated by routers and use different IP subnets.

• /30 networks were used for the two point-to-point routed links because each link only requires two usable IP addresses.

Layer 2 design: access and trunk links

A major learning point was that a link is not configured as a trunk simply because traffic may eventually communicate with other VLANs. The correct question is: How many VLANs cross this specific physical link?

• SW1 to R1 G0/1: trunk, because VLANs 10 and 30 share one cable.

• SW2 to R1 G0/2: access link in VLAN 20, because only VLAN 20 crosses that cable.

• PC-facing switch ports: access ports assigned to their respective VLANs.

• SW3 to R2: routed Layer 3 port, not an access port or trunk.

The SW2-to-R1 frames are untagged, which is intentional. The SW2 port is dedicated to VLAN 20, and R1 G0/2 represents the VLAN 20 subnet directly. R1 can still route VLAN 20 traffic to VLANs 10 and 30 internally; those other VLAN frames do not need to cross the SW2 link.

Layer 3 design

R1: hybrid inter-VLAN routing

R1 uses two methods:

1. Router-on-a-stick on G0/1 for VLANs 10 and 30. Subinterfaces use 802.1Q encapsulation and act as the default gateways.

2. A normal physical Layer 3 interface on G0/2 for VLAN 20. Because the link carries only VLAN 20, no subinterface or VLAN tag is required.

SW3: multilayer switching

SW3 performs inter-VLAN routing locally through SVIs:

• interface vlan 10 is the gateway for the right-site Office network.

• interface vlan 40 is the gateway for the Management network.

• ip routing enables Layer 3 forwarding between the SVIs.

• G1/0/1 is converted to a routed port with no switchport for the connection to R2.

Routing strategy

R1 and SW3 are edge Layer 3 devices with only one path toward remote networks, so each uses a default route pointing to R2. R2 sits in the middle and therefore requires specific routes to every VLAN subnet on both sides.

Configuration excerpts

R1

hostname R1

interface GigabitEthernet0/0
 description Transit_to_R2
 ip address 192.168.10.209 255.255.255.252
 no shutdown

interface GigabitEthernet0/1
 description Trunk_to_SW1
 no ip address
 no shutdown

interface GigabitEthernet0/1.10
 encapsulation dot1Q 10
 ip address 192.168.10.206 255.255.255.240

interface GigabitEthernet0/1.30
 encapsulation dot1Q 30
 ip address 192.168.10.126 255.255.255.192

interface GigabitEthernet0/2
 description VLAN20_HR_to_SW2
 ip address 192.168.10.158 255.255.255.224
 no shutdown

ip route 0.0.0.0 0.0.0.0 192.168.10.210

SW1

hostname SW1

vlan 10
 name OFFICE
vlan 30
 name ADMIN

interface range FastEthernet0/1-2
 switchport mode access
 switchport access vlan 30

interface range FastEthernet0/3-4
 switchport mode access
 switchport access vlan 10

interface GigabitEthernet0/1
 description Trunk_to_R1
 switchport mode trunk
 switchport trunk allowed vlan 10,30

SW2

hostname SW2

vlan 20
 name HR

interface range FastEthernet0/1-2
 switchport mode access
 switchport access vlan 20

interface GigabitEthernet0/1
 description Access_link_to_R1_G0/2
 switchport mode access
 switchport access vlan 20

R2

hostname R2

interface GigabitEthernet0/0
 description Transit_to_R1
 ip address 192.168.10.210 255.255.255.252
 no shutdown

interface GigabitEthernet0/1
 description Transit_to_SW3
 ip address 192.168.10.213 255.255.255.252
 no shutdown

ip route 192.168.10.64 255.255.255.192 192.168.10.209
ip route 192.168.10.128 255.255.255.224 192.168.10.209
ip route 192.168.10.192 255.255.255.240 192.168.10.209
ip route 192.168.10.0 255.255.255.192 192.168.10.214
ip route 192.168.10.160 255.255.255.224 192.168.10.214

SW3

hostname SW3

ip routing

vlan 10
 name OFFICE
vlan 40
 name MANAGEMENT

interface Vlan10
 ip address 192.168.10.158 255.255.255.224
 no shutdown

interface Vlan40
 ip address 192.168.10.62 255.255.255.192
 no shutdown

interface range GigabitEthernet1/0/2-5
 switchport mode access
 switchport access vlan 40

interface range GigabitEthernet1/0/6-8
 switchport mode access
 switchport access vlan 10

interface GigabitEthernet1/0/1
 description Routed_link_to_R2
 no switchport
 ip address 192.168.10.214 255.255.255.252
 no shutdown

ip route 0.0.0.0 0.0.0.0 192.168.10.213

Troubleshooting and learning process

1. Understanding how many networks existed

I initially viewed the topology as two LANs: one behind R1 and one behind R2. Physically, that is a reasonable site-level view, but logically each VLAN is its own Layer 2 broadcast domain and requires its own IP subnet. The final topology therefore contains five VLAN-based LANs plus two routed transit networks.

2. Reusing the same IP network

I briefly confused the idea that separate private networks can reuse the same addresses. Reuse is possible when networks are isolated, but normally routed networks that must communicate require unique prefixes. Otherwise, a router treats the duplicate prefix as locally connected and cannot determine which side contains the destination.

3. Allocating VLSM in the wrong order

My first attempt allocated the 10-host /28 subnet before a 34-host /26 subnet. Although .16 was the next unused address, it was not a valid /26 network boundary; a /26 must begin at .0, .64, .128, or .192. I corrected the plan by sorting requirements from largest to smallest before assigning subnets.

4. Confusing communication with trunking

I initially thought the SW2-to-R1 link had to become a trunk for VLAN 20 to communicate with VLANs 10 and 30. The breakthrough was understanding that the router performs Layer 3 routing internally. The SW2 link itself carries only VLAN 20 frames, so an access link is sufficient. A trunk is only needed when multiple VLANs must share the same physical cable.

5. Choosing between router-on-a-stick and SVIs

The lab intentionally uses both designs. R1 demonstrates router-on-a-stick, while SW3 demonstrates inter-VLAN routing through SVIs. The SW3-to-R2 link is a routed port because SW3 has already removed the Layer 2 VLAN separation before forwarding traffic toward R2.

6. Reducing static-route configuration

Configuring every remote VLAN route on every Layer 3 device would work but would be repetitive. I used default routes on R1 and SW3 because both devices have a single path to remote networks. R2 retains the specific static routes because it must choose between the left and right sides.

Validation

I tested connectivity in stages:

1. Pings between hosts in the same VLAN and subnet.

2. Pings between VLANs connected to R1.

3. Pings between VLANs routed locally by SW3.

4. Pings from a left-site VLAN to a right-site VLAN through R1, R2, and SW3.

5. End-to-end tests among all configured PCs.

All PCs were ultimately able to ping successfully, confirming that VLAN membership, subnet masks, default gateways, trunks, access links, SVIs, routed interfaces, and static routes were working together correctly.

Key takeaways

• One VLAN normally maps to one IP subnet and one broadcast domain.

• Connected routed networks need unique IP prefixes.

• VLSM should be allocated from the largest host requirement to the smallest.

• A link carrying one VLAN is normally an access link; a link carrying multiple VLANs is a trunk.

• VLAN traffic can communicate through a router even when one of the router links is not a trunk.

• Router-on-a-stick uses subinterfaces and 802.1Q tagging.

• A multilayer switch uses SVIs and ip routing for inter-VLAN routing.

• A routed switch port uses no switchport and belongs to a point-to-point IP subnet.

• Default routes are useful at network edges with a single exit path.

• Successful troubleshooting depends on understanding the forwarding process, not only memorizing commands.

Reflection

This project was especially meaningful because I did not simply reproduce a finished lab. I created the topology, calculated the address plan, questioned my assumptions, corrected subnetting mistakes, and worked through the purpose of access ports, trunks, SVIs, subinterfaces, and static routes.

The successful pings were the final proof, but the most valuable result was developing a clearer mental model of how Ethernet frames move inside a VLAN and how IP packets are routed between different networks. This lab strengthened my networking foundation and gave me a project I can continue extending with services, security controls, redundancy, and dynamic routing.